update specs for user controller
prevent user creation when card fails